@takodotid/circuit 0.23.0 → 0.25.0

package/src/adapters/devices/vrp/index.ts

@@ -609,6 +609,7 @@ export function unsupported(device: Device): string[] {
         if (iface.type !== "vlan" && iface.type !== "lag") found.push(`interfaces.${name}, a ${iface.type}`);
         if (iface.type === "lag" && iface.addresses?.length) found.push(`interfaces.${name}.addresses, LAGs are switched`);
         if (iface.mtu !== undefined) found.push(`interfaces.${name}.mtu`);
+        if (iface.ipv6_ra) found.push(`interfaces.${name}.ipv6_ra`);
         for (const group of iface.vrrp ?? []) if (familyOf(group.address) === "ipv6") found.push(`interfaces.${name}.vrrp for IPv6`);
     }
 
@@ -621,6 +622,10 @@ export function unsupported(device: Device): string[] {
     if (routing?.rpki) found.push("routing.rpki");
     if (routing?.ospf?.families?.includes("ipv6")) found.push("routing.ospf for IPv6");
 
+    for (const [index, route] of (routing?.static ?? []).entries()) {
+        if (route.description && familyOf(split(route.prefix).addr) === "ipv6") found.push(`routing.static[${index}].description for IPv6`);
+    }
+
     for (const field of ["firewall", "dhcp", "acls", "policies", "prefix_sets", "hardware_offload", "certificates"] as const) {
         if (device[field] !== undefined) found.push(field);
     }

package/src/core/across.ts

@@ -25,16 +25,28 @@ export function checkAcross(devices: readonly Device[]): Finding[] {
     ];
 }
 
-/** The VLAN ids a port carries, by how it carries them, so two ends can be compared across devices. */
-function carried(device: Device, port: Port<string, string, string, string>) {
+/** The VLAN ids a port or LAG carries, by how it carries them, so two ends can be compared across devices. */
+function carried(device: Device, settings: Switched<string>) {
     const id = (vlan: string | undefined) => (vlan ? device.vlans?.[vlan]?.id : undefined);
     return {
-        access: id(port.access_vlan),
-        native: id(port.native_vlan),
-        trunk: (port.trunk_vlans ?? []).map(id).sort((a, b) => (a ?? 0) - (b ?? 0)),
+        access: id(settings.access_vlan),
+        native: id(settings.native_vlan),
+        trunk: (settings.trunk_vlans ?? []).map(id).sort((a, b) => (a ?? 0) - (b ?? 0)),
     };
 }
 
+/** How a port carries its VLANs, in words: "VLANs 10, 20 tagged and VLAN 30 untagged as native". */
+function describeCarried({ access, native, trunk }: ReturnType<typeof carried>): string {
+    const parts: string[] = [];
+    const tagged = trunk.filter((id) => id !== undefined);
+
+    if (access !== undefined) parts.push(`VLAN ${access} untagged`);
+    if (tagged.length) parts.push(`${tagged.length === 1 ? "VLAN" : "VLANs"} ${tagged.join(", ")} tagged`);
+    if (native !== undefined) parts.push(`VLAN ${native} untagged as native`);
+
+    return parts.length ? parts.join(" and ") : "no VLANs";
+}
+
 /** VLAN names by id, for the VLANs a port or LAG carries. */
 function vlanNames(device: Device, settings: Switched<string>): Map<number, string> {
     const names = [settings.access_vlan, settings.native_vlan, ...(settings.trunk_vlans ?? [])].filter((name) => name !== undefined);
@@ -114,17 +126,30 @@ function checkLinks(devices: readonly Device[]): Finding[] {
                 continue;
             }
 
-            const here = JSON.stringify(carried(device, port));
-            const there = JSON.stringify(carried(far, farPort));
-            if (here !== there) report(`carries ${here}, and ${link.device} ${link.port} carries ${there}`);
+            const near = carrierOf(device, portName, port);
+            const away = carrierOf(far, link.port, farPort);
+
+            // A LAG's VLANs are on the LAG, so its member ports are compared by what their LAGs carry.
+            const inLag = near.name !== portName;
+            const farInLag = away.name !== link.port;
+            if (inLag !== farInLag) {
+                report(
+                    inLag
+                        ? `${portName} is in ${near.name}, and ${link.device} ${link.port} is in no LAG`
+                        : `${portName} is in no LAG, and ${link.device} ${link.port} is in ${away.name}`
+                );
+            }
+
+            const here = carried(device, near.settings);
+            const there = carried(far, away.settings);
+            if (JSON.stringify(here) !== JSON.stringify(there)) {
+                report(`${near.name} carries ${describeCarried(here)}, and ${link.device} ${away.name} carries ${describeCarried(there)}`);
+            }
 
             if (port.speed && farPort.speed && port.speed !== farPort.speed) {
                 report(`speed ${port.speed}, and ${link.device} ${link.port} is ${farPort.speed}`);
             }
 
-            const near = carrierOf(device, portName, port);
-            const away = carrierOf(far, link.port, farPort);
-
             const mtu = near.settings.mtu ?? 1500;
             const farMtu = away.settings.mtu ?? 1500;
             if (mtu !== farMtu) report(`MTU ${mtu} on ${near.name}, and ${link.device} ${away.name} has ${farMtu}`);
@@ -144,7 +169,7 @@ function checkLinks(devices: readonly Device[]): Finding[] {
     return findings;
 }
 
-/** No address is held by two devices. Two loopbacks may hold one on purpose, for anycast, so that is a warning. */
+/** No address is held by two devices in one VRF. Two loopbacks may hold one on purpose, for anycast, so that is a warning. */
 function checkAddresses(holders: Holder[]): Finding[] {
     const findings: Finding[] = [];
     const first = new Map<string, Holder>();
@@ -152,7 +177,7 @@ function checkAddresses(holders: Holder[]): Finding[] {
     const isLoopback = (holder: Holder) => holder.device.interfaces?.[holder.name]?.type === "loopback";
 
     for (const holder of holders) {
-        const key = keyOf(host(holder.address))!;
+        const key = `${holder.vrf ?? ""} ${keyOf(host(holder.address))!}`;
         const earlier = first.get(key);
 
         if (!earlier) {
@@ -296,13 +321,16 @@ function checkTunnels(devices: readonly Device[], owners: Map<string, Holder>):
             findings.push({ level: "error", device: end.device.name, message: `interface ${end.name}: ${message}` });
         const kind = end.iface.type === "gre" ? "GRE" : "VXLAN";
 
-        const mirror = ends.find(
+        // Two routers may run several VXLAN tunnels between them, one for each VNI, so a tunnel pairs with the one of its own VNI first.
+        const back = ends.filter(
             (other) =>
                 other.device === far &&
                 other.iface.type === end.iface.type &&
                 same(other.iface.local, end.iface.remote) &&
                 same(other.iface.remote, end.iface.local)
         );
+        const vniOf = (iface: Gre<string> | Vxlan<string>) => (iface.type === "vxlan" ? iface.vni : undefined);
+        const mirror = back.find((other) => vniOf(other.iface) === vniOf(end.iface)) ?? back[0];
 
         if (!mirror) {
             report(`${end.iface.remote} is ${far.name}'s, which has no ${kind} tunnel from there back to ${end.iface.local}`);

package/src/core/graph.ts

@@ -72,6 +72,8 @@ export type Holder = {
     /** The far end of a point-to-point address. */
     peer?: string;
     vrrp: NonNullable<Routed<string>["vrrp"]>;
+    /** The VRF the address is in. The default table when absent. */
+    vrf?: string;
 };
 
 export const deviceId = (name: string) => `device:${name}`;
@@ -124,7 +126,7 @@ export function holdersOf(devices: readonly Device[]): Holder[] {
                 if (!isCidr(address)) return [];
 
                 const peer = typeof entry === "string" ? undefined : entry.peer;
-                return [{ device, name, address, peer, vrrp: settings.vrrp ?? [] }];
+                return [{ device, name, address, peer, vrrp: settings.vrrp ?? [], vrf: settings.vrf }];
             })
         )
     );

package/src/core/validate.ts

@@ -101,7 +101,7 @@ function checkVlans(device: Device, report: Report): void {
     }
 }
 
-/** Every address is valid, and no address sits on two interfaces. */
+/** Every address is valid, and no address sits on two interfaces of one routing table. Two VRFs may hold the same address. */
 function checkAddresses(device: Device, report: Report, cidr: Checker, ip: Checker): void {
     const holderOf = new Map<string, string>();
     const holders = [
@@ -116,8 +116,9 @@ function checkAddresses(device: Device, report: Report, cidr: Checker, ip: Check
             if (typeof entry !== "string") ip(where, entry.peer);
 
             const bare = address.split("/")[0]!;
-            if (holderOf.has(bare)) report(`${bare} is on both ${holderOf.get(bare)} and ${where}`);
-            holderOf.set(bare, where);
+            const key = `${settings?.vrf ?? ""} ${bare}`;
+            if (holderOf.has(key)) report(`${bare} is on both ${holderOf.get(key)} and ${where}`);
+            holderOf.set(key, where);
         }
 
         for (const group of settings?.vrrp ?? []) {

package/src/presets/index.ts

@@ -496,7 +496,7 @@ export type InternetExchange<V extends string> = {
  * Member ports and a check for an internet exchange's fabric.
  *
  * - `ports(device)`: every member's port on one switch. A member port is in the peering VLAN and nothing else, takes no part in spanning tree or LLDP, and lets only a trickle of broadcast, multicast and unknown unicast through.
- * - `check`: members never share a name, an AS or an address; every address is inside the peering LAN and not reserved; every member port carries the peering VLAN alone.
+ * - `check`: members never share a name, an AS, an address or a port; every address is inside the peering LAN and not reserved; every member port carries the peering VLAN alone.
  */
 export function internetExchange<const V extends string>(exchange: InternetExchange<V>, members: readonly ExchangeMember[]) {
     const percent = exchange.storm_percent ?? 1;
@@ -524,6 +524,8 @@ export function internetExchange<const V extends string>(exchange: InternetExcha
         const findings: Finding[] = [];
         const error = (message: string, device?: string) => findings.push({ level: "error", ...(device ? { device } : {}), message });
         const taken = new Map<string, string>((exchange.reserved ?? []).map((address) => [address, "reserved"]));
+        // `ports()` writes one port per name, so a second member on a port would silently replace the first.
+        const portHolders = new Map<string, string>();
 
         members.forEach((member, index) => {
             for (const other of members.slice(index + 1)) {
@@ -544,6 +546,10 @@ export function internetExchange<const V extends string>(exchange: InternetExcha
             }
 
             for (const [deviceName, portName] of Object.entries(member.ports)) {
+                const holder = portHolders.get(`${deviceName} ${portName}`);
+                if (holder) error(`port ${portName} is given to both ${holder} and ${member.name}`, deviceName);
+                portHolders.set(`${deviceName} ${portName}`, member.name);
+
                 const device = devices.find((candidate) => candidate.name === deviceName);
                 const port = device?.ports?.[portName as keyof typeof device.ports];
                 const carried = port ? vlansOf(port) : [];

package/templates/colocation/checks.ts

@@ -12,7 +12,7 @@ export default [
     // Traffic from the transit and the exchange reaches the tenants only through the router, which filters it.
     trustBoundary({ untrusted: ["transit", "ix"], routers: ["edge-01"] }),
 
-    // Tenants never share a name, a number or an address.
+    // Tenants never share a name, a number, an address or a port. A port given twice would go to the last tenant alone.
     () => {
         const findings: Finding[] = [];
         const error = (message: string) => findings.push({ level: "error", message });
@@ -28,6 +28,13 @@ export default [
                 }
             }
 
+            for (const [device, ports] of Object.entries(t.ports)) {
+                for (const port of Object.keys(ports)) {
+                    const sharer = TENANTS.slice(index + 1).find((other) => other.ports[device]?.[port]);
+                    if (sharer) error(`port ${port} on ${device} is given to both ${t.name} and ${sharer.name}`);
+                }
+            }
+
             for (const { prefix, gateway } of t.blocks) {
                 if (!contains(prefix, gateway)) error(`the gateway ${gateway} of ${t.name} is outside ${prefix}`);
             }

package/templates/single-site/router.ts

@@ -69,16 +69,13 @@ export default defineDevice({
                     { description: "DNS from guests", match: { in_interface: "guests", protocol: "udp", dst_port: 53 }, action: "accept" },
                 ],
             },
-            // Traffic passing through the router.
+            // Traffic passing through the router: home and guests reach the internet, and nothing else gets through.
             forward: {
+                default: "drop",
                 rules: [
                     { description: "Replies", match: { state: ["established", "related"] }, action: "accept", offload: true },
-                    {
-                        description: "Guests stay off the home network",
-                        match: { in_interface: "guests", out_interface: "home" },
-                        action: "drop",
-                    },
-                    { description: "Guests stay off management", match: { in_interface: "guests", out_interface: "mgmt" }, action: "drop" },
+                    { description: "Home to the internet", match: { in_interface: "home", out_interface: "1g-1" }, action: "accept" },
+                    { description: "Guests to the internet", match: { in_interface: "guests", out_interface: "1g-1" }, action: "accept" },
                 ],
             },
         },